CVE-2018-1999043: Missing Release of Resource after Effective Lifetime in Jenkins
Summary
CVE-2018-1999043: Missing Release of Resource after Effective Lifetime in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.3
>= 2.122, < 2.138
Fixed in 2.121.3 or 2.138, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development and deployment workflows. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for handling user authentication and authorization.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1999043, affects Jenkins versions 2.137 and earlier, as well as 2.121.2 and earlier. It resides in the BasicAuthenticationFilter.java and BasicHeaderApiTokenAuthenticator.java files. Attackers can exploit this flaw to create ephemeral in-memory user records by attempting to log in using invalid credentials. This can lead to a denial of service (DoS) scenario, potentially impacting the availability of the Jenkins server.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.32.121.3 -
>= 2.122, < 2.1382.138
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring they are running a patched version of Jenkins as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, CVE-2018-1999043 is a vulnerability in Jenkins that allows attackers to create ephemeral in-memory user records. It is crucial for Jenkins users to upgrade to the patched versions mentioned in the 'how_to_fix' section to mitigate the risk of a denial of service scenario. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
The impacted package is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for user authentication and authorization.
The vulnerability allows attackers to create ephemeral in-memory user records, potentially leading to a denial of service scenario.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Jenkins as mentioned in the 'how_to_fix' section.
There is no specific workaround provided, but users can mitigate the risk by ensuring they are running a patched version of Jenkins.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
